Win32/Filecoder.Cerber.H

.123
.1cd
.3dm
.3ds
.3fr
.3g2
.3gp
.3pr
.602
.7z
.7zip
.aac
.ab4
.abd
.acc
.accdb
.accde
.accdr
.accdt
.ach
.acr
.act
.adb
.adp
.ads
.aes
.agdl
.ai
.aiff
.ait
.al
.aoi
.apj
.apk
.arc
.arw
.ascx
.asf
.asm
.asp
.aspx
.asset
.asx
.atb
.avi
.awg
.back
.backup
.backupdb
.bak
.bank
.bat
.bay
.bdb
.bgt
.bik
.bin
.bkp
.blend
.bmp
.bpw
.brd
.bsa
.bz2
.c
.cash
.cdb
.cdf
.cdr
.cdr3
.cdr4
.cdr5
.cdr6
.cdrw
.cdx
.ce1
.ce2
.cer
.cfg
.cfn
.cgm
.cib
.class
.cls
.cmd
.cmt
.config
.contact
.cpi
.cpp
.cr2
.craw
.crt
.crw
.cry
.cs
.csh
.csl
.csr
.css
.csv
.d3dbsp
.dac
.das
.dat
.db
.db3
.db_journal
.dbf
.dbx
.dc2
.dch
.dcr
.dcs
.ddd
.ddoc
.ddrw
.dds
.def
.der
.des
.design
.dgc
.dgn
.dif
.dip
.dit
.djv
.djvu
.dng
.doc
.docb
.docm
.docx
.dot
.dotm
.dotx
.drf
.drw
.dtd
.dwg
.dxb
.dxf
.dxg
.edb
.eml
.eps
.erbsql
.erf
.exf
.fdb
.ffd
.fff
.fh
.fhd
.fla
.flac
.flb
.flf
.flv
.forge
.fpx
.frm
.fxg
.gbr
.gho
.gif
.gpg
.gray
.grey
.groups
.gry
.gz
.h
.hbk
.hdd
.hpp
.html
.hwp
.ibank
.ibd
.ibz
.idx
.iif
.iiq
.incpas
.indd
.info
.info_
.iwi
.jar
.java
.jnt
.jpe
.jpeg
.jpg
.js
.json
.k2p
.kc2
.kdbx
.kdc
.key
.kpdx
.kwm
.laccdb
.lay
.lay6
.lbf
.lck
.ldf
.lit
.litemod
.litesql
.lock
.ltx
.lua
.m
.m2ts
.m3u
.m4a
.m4p
.m4u
.m4v
.ma
.mab
.mapimail
.max
.mbx
.md
.mdb
.mdc
.mdf
.mef
.mfw
.mid
.mkv
.mlb
.mml
.mmw
.mny
.money
.moneywell
.mos
.mov
.mp3
.mp4
.mpeg
.mpg
.mrw
.ms11
.msf
.msg
.mts
.myd
.myi
.nd
.ndd
.ndf
.nef
.nk2
.nop
.nrw
.ns2
.ns3
.ns4
.nsd
.nsf
.nsg
.nsh
.nvram
.nwb
.nx2
.nxl
.nyf
.oab
.obj
.odb
.odc
.odf
.odg
.odm
.odp
.ods
.odt
.ogg
.oil
.omg
.one
.onenotec2
.orf
.ost
.otg
.oth
.otp
.ots
.ott
.p12
.p7b
.p7c
.pab
.pages
.paq
.pas
.pat
.pbf
.pcd
.pct
.pdb
.pdd
.pdf
.pef
.pem
.pfx
.php
.pif
.pl
.plc
.plus_muhd
.pm
.pm!
.pmi
.pmj
.pml
.pmm
.pmo
.pmr
.pnc
.pnd
.png
.pnx
.pot
.potm
.potx
.ppam
.pps
.ppsm
.ppsx
.ppt
.pptm
.pptx
.prf
.private
.ps
.psafe3
.psd
.pspimage
.pst
.ptx
.pub
.pwm
.py
.qba
.qbb
.qbm
.qbr
.qbw
.qbx
.qby
.qcow
.qcow2
.qed
.qtb
.r3d
.raf
.rar
.rat
.raw
.rb
.rdb
.re4
.rm
.rtf
.rvt
.rw2
.rwl
.rwz
.s3db
.safe
.sas7bdat
.sav
.save
.say
.sch
.sd0
.sda
.sdb
.sdf
.secret
.sh
.sldm
.sldx
.slk
.slm
.sql
.sqlite
.sqlite-shm
.sqlite-wal
.sqlite3
.sqlitedb
.sr2
.srb
.srf
.srs
.srt
.srw
.st4
.st5
.st6
.st7
.st8
.stc
.std
.sti
.stl
.stm
.stw
.stx
.svg
.swf
.sxc
.sxd
.sxg
.sxi
.sxm
.sxw
.tar
.tax
.tbb
.tbk
.tbn
.tex
.tga
.tgz
.thm
.tif
.tiff
.tlg
.tlx
.txt
.uop
.uot
.upk
.usr
.vb
.vbox
.vbs
.vdi
.vhd
.vhdx
.vmdk
.vmsd
.vmx
.vmxf
.vob
.vpd
.vsd
.wab
.wad
.wallet
.war
.wav
.wb2
.wk1
.wks
.wma
.wmf
.wmv
.wpd
.wps
.x11
.x3f
.xis
.xla
.xlam
.xlc
.xlk
.xlm
.xlr
.xls
.xlsb
.xlsm
.xlsx
.xlt
.xltm
.xltx
.xlw
.xml
.xps
.xxx
.ycbcra
.yuv
.zip

bootsect.bak
iconcache.db
ntuser.dat
thumbs.db

.bat
.cmd
.com
.cpl
.dll
.exe
.hta
.msc
.msi
.msp
.pif
.scf
.scr
.sys

:\$getcurrent\
:\$recycle.bin\
:\$windows.~bt\
:\$windows.~ws\
:\boot\
:\documents and settings\all users\
:\documents and settings\default user\
:\documents and settings\localservice\
:\documents and settings\networkservice\
:\intel\
:\msocache\
:\perflogs\
:\program files (x86)\
:\program files\
:\programdata\
:\recovery\
:\recycled\
:\recycler\
:\system volume information\
:\temp\
:\windows.old\
:\windows10upgrade\
:\windows\
:\winnt\
\appdata\local\
\appdata\locallow\
\appdata\roaming\
\local settings\
\public\music\sample music\
\public\pictures\sample pictures\
\public\videos\sample videos\
\tor browser\

%10randomchars%.%variable%

_HELP_HELP_HELP_%randomstring%_.png
_HELP_HELP_HELP_%randomstring%_.hta

_HELP_HELP_HELP_%randomstring%_.png
_HELP_HELP_HELP_%randomstring%_.hta

CERBER RANSOMWARE
Instructions

Can't you find the necessary files?
Is the content of your files not readable?

It is normal because the files' names and the data in your files have been encrypted by "Cerber Ransomware".

It means your files are NOT damaged! Your files are modified only. This modification is reversible.
From now it is not possible to use your files until they will be decrypted.

The only way to decrypt your files safely is to buy the special decryption software "Cerber Decryptor".

Any attempts to your files with the third-party software will be fatal for your files!

--------------------------------------------------------------------------------

You can proceed with purchasing of the decryption software at your personal page:

Please wait...http://hjhqmbxyinislkkt.1mswjm.top/%removed%
--------------------------------------------------------------------------------
http://hjhqmbxyinislkkt.1jnhdc.top/%removed%
--------------------------------------------------------------------------------
http://hjhqmbxyinislkkt.1bcxcs.top/%removed%
--------------------------------------------------------------------------------
http://hjhqmbxyinislkkt.12bsy8.top/%removed%
--------------------------------------------------------------------------------
http://hjhqmbxyinislkkt.1qjl23.top/%removed%

If this page cannot be opened click here to get a new address of your personal page.

If the address of your personal page is the same as before after you tried to get a new one,
you can try to get a new address in one hour.

At this page you will receive the complete instructions how to buy the decryption software for restoring all your files.

Also at this page you will be able to any one file for free to be sure "Cerber Decryptor" will help you.


--------------------------------------------------------------------------------

If your personal page is not available for a long period there is another way to open your personal page - installation and use of Tor Browser:

run your Internet browser (if you do not know what it is run the Internet Explorer);
enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER;
wait for the site loading;
on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;
run Tor Browser;
connect with the button "Connect" (if you use the English version);
a normal Internet browser window will be opened after the initialization;
type or copy the address
http://hjhqmbxyinislkkt.onion/D422-51FD-C61E-05C5-%removed%
in this browser address bar;
press ENTER;
the site should be loaded; if for some reason the site is not loading wait for a moment and try again.
If you have any problems during installation or use of Tor Browser, please, visit https://www.youtube.com and type request in the search bar "Install Tor Browser Windows" and you will find a lot of training videos about Tor Browser installation and use.


--------------------------------------------------------------------------------

Additional information:

You will find the instructions ("*_HELP_HELP_HELP_*.hta") for restoring your files in any folder with your encrypted files.

The instructions "*_HELP_HELP_HELP_*.hta" in the folders with your encrypted files are not viruses! The instructions "*_HELP_HELP_HELP_*.hta" will help you to decrypt your files.

Remember! The worst situation already happened and now the future of your files depends on your determination and speed of your actions.

OSのバージョン

Attention! Attention! Attention!
Your documents, photos, databases and other important files have been encrypted!

%temp%\%variable1%\files.txt
%temp%\%variable1%%\%variable2%
%temp%\%variable1%\%variable3%
C:\test\cerber_debug.txt
C:\test\cerber_debug2.txt

agntsvc.exeagntsvc.exe
agntsvc.exeencsvc.exe
agntsvc.exeisqlplussvc.exe
bitcoin-qt.exe
dbeng50.exe
dbsnmp.exe
fbserver.exe
firefoxconfig.exe
msftesql.exe
mydesktopqos.exe
mydesktopservice.exe
mysqld-nt.exe
mysqld-opt.exe
mysqld.exe
ocautoupds.exe
ocomm.exe
ocssd.exe
oracle.exe
sqbcoreservice.exe
sqlagent.exe
sqlbrowser.exe
sqlservr.exe
sqlwriter.exe
synctime.exe
tbirdconfig.exe
xfssvccon.exe